11 September 2026

A fake email from the tax office or social security: how to tell it is a scam

A few years ago an email claiming to be from the tax authority gave itself away at once: the language was laughable, the logo was stretched, the subject line carried three exclamation marks. Not any more. With generative AI, any scammer can write a demand in impeccable Catalan, French or English, with the right administrative tone, a well-formed case number, and a landing page that is an almost exact copy of the official portal.

The result is that the rule we all used — "if it is badly written, it is fake" — no longer works. And that leaves us without our main filter precisely in the season when most of these emails circulate: around quarterly filing deadlines.

What they are actually after

They do not always want you to pay. Often they are after one of three things:

• Your credentials. For the tax portal, the bank or the corporate mailbox.
• Your digital certificate. It is the master key: with it they can file returns, claim grants or register changes in your company's name.
• That you open an attachment. It installs malware and opens the door to every other computer in the office.

The "outstanding debt" or the "urgent notification" is only the excuse to create hurry.

A case like so many others

A cleaning company with nine staff received an email claiming to be from social security: there was a discrepancy in one employee's contributions and they had 48 hours to correct it before a penalty. The email carried the right logo, exactly the right administrative language, and a link to "the electronic office".

The person in administration clicked and landed on a page identical to the real one. She stopped over a small detail: the browser did not offer her the digital certificate that always pops up when she logs in for real. She phoned the official social security number — not the one in the email — and was told there was no open case. The scam ended as a ten-minute scare.

The warning signs that still work

The writing no longer tells you anything, but there are signals AI cannot dress up:

• The sender's domain. Government bodies write from official government domains (in Spain, ones ending in .gob.es or .seg-social.es). Any creative variant — agenciatributaria-es.com, sede-agenciatributaria.net, segsocial.info — is fake, however well it is written.
• Impossible deadlines. Public administration does not give you 24 or 48 hours by email. Real deadlines arrive by official electronic notification and run to days or weeks.
• Asking for data by email. The tax office and social security will never ask you for an account number, a password, or to upload your digital certificate to a form.
• Links that do not match. Hover over the link without clicking: at the bottom of the browser or mail client you will see the real address. If it is not the same as the text, out.
• Unexpected refunds and grants. "You have a pending refund of €1,842" is the oldest bait there is and it still works, because nobody looks closely at good news.

The two-minute checks

When one of these emails arrives, do not reply and do not click anything. Do three things:

1. Go in your usual way. Open the browser and type the portal's address yourself, or use the bookmark you already have. If there is a real demand, it will be there: official notifications can always be consulted from the portal, never only from a link.
2. Call the official number. The one on the website, not the one in the email. Two minutes on hold cost far less than a penalty or a stolen certificate.
3. Ask your accountant. If you have one, they know best which cases you actually have open. A quick message with a screenshot usually settles it.

What to do if you have already clicked

If someone on the team has entered credentials or opened an attachment, the clock is running:

• Change the password immediately on the affected account and on any other where you reuse it. This is exactly why passwords must never be reused.
• Turn on two-factor authentication if you have not already.
• Revoke and reissue the digital certificate if there is any chance it was exposed. It is an awkward procedure; replacing it with an impersonation complaint is far more awkward.
• Disconnect the computer from the network if an attachment was opened, and have it checked before putting it back.
• Tell the rest of the team, with the screenshot, so nobody else falls for the same one.

And if money has moved, the sequence is in the piece on the first 24 hours.

This article is general information, not legal or security advice for a specific case. The official domains named are the Spanish ones; the principle applies to any country's tax and social security bodies.